This invention relates generally to the field of computer systems. More particularly, a system and method are provided for authenticating a user against an external third-party directory rather than a local directory.
Directory servers and services such as Oracle® Corporation's OID (Oracle Internet Directory) service store commonly used information regarding users, applications and machines (e.g., computing devices). A directory service allows these entities to be organized into namespaces to facilitate the central management of user information, among other purposes. Information stored in a directory service may thus include roles, credentials, privileges, certificates, preferences, etc.
A directory service such as OID service may be used to authenticate users when they attempt to connect to a server or service (e.g., web server, database, application server) that is coupled to the directory service or resides within the namespace of the directory service. Thus, to access a database within a particular namespace, a directory server associated with that database receives a user's connection and attempts to authenticate the user (e.g., by comparing a password proffered by the user to the user's password stored in the directory). For example, users connecting to an Oracle database are normally authenticated through an OID server, which may be directly coupled to an application server.
Many organizations have heterogeneous networks and computing environment, possibly including multiple directory servers or other servers capable of authenticating users (e.g., legacy systems) or containing repositories of user information.
Unfortunately, it is not generally possible for one directory server or service to authenticate a user against another (e.g., external or third-party) directory service. Instead, each directory server must store the necessary access control information to authenticate a user.
Therefore, to enjoy the benefit of centralized management of user information, while still being able to access the applications or services offered by the organization's various servers, the user information may be synchronized or replicated among the servers. By copying the user information to each server that receives and approves user connections, each server continues to perform its own local authentication for each connection.
However, by sharing user information among the servers, a user's password (or other information) must be updated throughout the environment every time it changes. This may cause a substantial amount of network traffic. And, some information may not be shared or synchronized (e.g., because the owners or holders of the information will not release it).
Also, there will necessarily be some delay before updated or synchronized information is effective throughout the organization. During this time, a user may be unable to access a particular server or service.
Yet further, storing users' information in multiple locations can cause problems. For example, if just one of the servers is compromised, all users' credential information is at risk. And, if a problem occurs in the servers' synchronization, a subset of them may end up with obsolete information.